Home / server / Questions / 325352
In Process
NitroxDM
Asked: 2011-10-28 06:26:00 +0800 CST

IIS7.5: Basic Authentication with a domain

  • 772

I have a simple one page internal app that I just moved to IIS7.5. After enabling basic authentication and disabled anonymous authentication only local users can authenticate.

What I have done far:

  • Enabled basic authentication and disabled anonymous authentication.
  • Created group in Active Directory with accounts.
  • Added AD group to the local User group.
  • Added Network Service account to the directory.
  • Created a local test user. - Works.
  • Removed the local test user from all groups. - Still works.
  • I'm using DOMAIN\USER for the username.

There has to be something simple I'm missing.

windows-server-2008 iis-7.5

1 Answers

  1. To enable Windows authentication for a page, you'd normally:

    • Create a group in AD

    • Populate that group with users

    • In IIS Manager, open the directory you want to secure

    • Edit the Authentication settings for that directory
    • typically, they'd be:
      • enable Windows Authentication
      • disable Anonymous to avoid mucking around with file system permissions too much

    At this point, file system permissions will be used to govern whether an authenticated user has access to the site or not. So you just need to check file system permissions are OK:

    • Right-click and Explore the website in question
    • Edit the Security settings on the file you want to be authenticated (if it's not the whole folder)
      • Ensure that anonymous users are removed from Read permission to the file
      • Ensure that your chosen group does have Read permission to the file
      • Ensure the App Pool Identity has Read access to everything

    In your question, you talk about Integrated Windows authentication, but then describe enabling Basic authentication - that's not the same thing; from the client end (at least for IE), Basic always prompts for a username and password, and it transmits it unsecurely; Windows auth is more secure, and doesn't prompt for authentication (with caveats including dots in the URL, and Local Intranet Zone-ing).

    • 0